Table of Contents
Was this article helpful?
Try Vultr Today with

$50 Free on Us!

Want to contribute?

You could earn up to $600 by adding new articles.

How to Enable TLS 1.3 in Apache on Fedora 30

Last Updated: Fri, Oct 18, 2019
Fedora Linux Guides Security Web Servers
Archived content

This article is outdated and may not work correctly for current operating systems or software.

TLS 1.3 is a version of the Transport Layer Security (TLS) protocol that was published in 2018 as a proposed standard in RFC 8446. It offers security and performance improvements over its predecessors.

This guide will demonstrate how to enable TLS 1.3 using the Apache web server on Fedora 30.


  • Vultr Cloud Compute (VC2) instance running Fedora 30.

  • A valid domain name and properly configured A/AAAA/CNAME DNS records for your domain.

  • A valid TLS certificate. We will get one from Let's Encrypt.

  • Apache version 2.4.36 or greater.

  • OpenSSL version 1.1.1 or greater.

Before you begin

Check the Fedora version.

cat /etc/fedora-release

# Fedora release 30 (Thirty)

Create a new non-root user account with sudo access and switch to it.

useradd -c "John Doe" johndoe && passwd johndoe

usermod -aG wheel johndoe

su - johndoe

NOTE: Replace johndoe with your username.

Set up the timezone.

timedatectl list-timezones

sudo timedatectl set-timezone 'Region/City'

Ensure that your system is up to date.

sudo dnf check-upgrade || sudo dnf upgrade -y

Install the needed packages.

sudo dnf install -y socat git

Disable SELinux and Firewall.

sudo setenforce 0 ; sudo systemctl stop firewalld ; sudo systemctl disable firewalld

Install the client and obtain a TLS certificate from Let's Encrypt


sudo mkdir /etc/letsencrypt

git clone


sudo ./ --install --home /etc/letsencrypt --accountemail

cd ~

source ~/.bashrc

Check the version.

/etc/letsencrypt/ --version

# v2.8.2

Obtain RSA and ECDSA certificates for your domain.


sudo /etc/letsencrypt/ --issue --standalone -d --ocsp-must-staple --keylength 2048


sudo /etc/letsencrypt/ --issue --standalone -d --ocsp-must-staple --keylength ec-256

NOTE: Replace in commands with your domain name.

Create sensible directories to store your certs and keys in. We will use /etc/letsencrypt.

sudo mkdir -p /etc/letsencrypt/

sudo mkdir -p /etc/letsencrypt/example.com_ecc

Install and copy certificates to /etc/letsencrypt.


sudo /etc/letsencrypt/ --install-cert -d --cert-file /etc/letsencrypt/ --key-file /etc/letsencrypt/ --fullchain-file /etc/letsencrypt/ 


sudo /etc/letsencrypt/ --install-cert -d --ecc --cert-file /etc/letsencrypt/example.com_ecc/cert.pem --key-file /etc/letsencrypt/example.com_ecc/private.key --fullchain-file /etc/letsencrypt/example.com_ecc/fullchain.pem

After running the above commands, your certificates and keys will be in the following locations:

  • RSA: /etc/letsencrypt/

  • ECC/ECDSA: /etc/letsencrypt/example.com_ecc

Install Apache

Apache added support for TLS 1.3 in version 2.4.36. Fedora 30 system comes with Apache and OpenSSL that support TLS 1.3 out of the box, so there is no need to build a custom version.

Download and install the latest 2.4 branch of Apache and its module for SSL via the dnf package manager.

sudo dnf install -y httpd mod_ssl

Check the version.

sudo httpd -v

# Server version: Apache/2.4.39 (Fedora)

# Server built:   May  2 2019 14:50:28

Start and enable Apache.

sudo systemctl start httpd.service

sudo systemctl enable httpd.service

Configure Apache for TLS 1.3

Now that we have successfully installed Apache, we are ready to configure it to start using TLS 1.3 on our server.

Run sudo vim /etc/httpd/conf.d/, and populate the file with the following basic configuration.

<IfModule mod_ssl.c>

  <VirtualHost *:443>


    SSLEngine on

    SSLProtocol all -SSLv2 -SSLv3

    # RSA

    SSLCertificateFile "/etc/letsencrypt/"

    SSLCertificateKeyFile "/etc/letsencrypt/"

    # ECC

    SSLCertificateFile "/etc/letsencrypt/example.com_ecc/fullchain.pem"

    SSLCertificateKeyFile "/etc/letsencrypt/example.com_ecc/private.key"



Save the file and exit.

Check the configuration.

sudo apachectl configtest

Reload Apache to activate the new configuration.

sudo systemctl reload httpd.service

Open your site via HTTPS protocol in your web browser. To verify TLS 1.3, you can use browser dev tools or SSL Labs service. The screenshots below show Chrome's security tab with TLS 1.3 in action.

You have successfully enabled TLS 1.3 in Apache on your Fedora 30 server. The final version of TLS 1.3 was defined in August 2018, so there’s no better time to start adopting this new technology.

Want to contribute?

You could earn up to $600 by adding new articles.